爆破一個二元函數加密的cm

時間 2019-12-06

標籤爆破一個二元 2元函數加密简体版

原文原文鏈接

系統： Windows xpphp

程序： cztria~1函數

程序下載地址：http://pan.baidu.com/s/1slUwmVr
工具

要求：爆破加密

使用工具： OD spa

可在看雪論壇中查找關於此程序的破文：傳送門code

廢話很少說，直接查詢到字符串：「 you did it!」，雙擊定位：blog

0040137B  |.  6A 40         push    40                               ; /Count = 40 (64.)
0040137D  |.  68 20334000   push    00403320                         ; |pediy
00401382  |.  FF35 66324000 push    dword ptr [403266]               ; |hWnd = 000405D8 (class='Edit',parent=000505C0)
00401388  |.  E8 A3080000   call    <jmp.&USER32.GetWindowTextA>     ; \GetWindowTextA
0040138D  |.  83F8 04       cmp     eax, 4                           ; 小於等於4？
00401390  |.  0F8E 9F000000 jle     00401435
00401396  |.  6A 40         push    40                               ; /Count = 40 (64.)
00401398  |.  68 60334000   push    00403360                         ; |12345
0040139D  |.  68 B90B0000   push    0BB9                             ; |ControlID = BB9 (3001.)
004013A2  |.  FF75 08       push    dword ptr [ebp+8]                ; |hWnd
004013A5  |.  E8 6E080000   call    <jmp.&USER32.GetDlgItemTextA>    ; \GetDlgItemTextA
004013AA  |.  83F8 04       cmp     eax, 4                           ; 小於等於4？
004013AD  |.  0F8E 82000000 jle     00401435
004013B3  |.  A3 62324000   mov     dword ptr [403262], eax 004013B8  |.  FF35 66324000 push    dword ptr [403266]               ; /hWnd = 000405D8 (class='Edit',parent=000505C0)
004013BE  |.  E8 AF080000   call    <jmp.&USER32.SetFocus>           ; \SetFocus
004013C3  |.  BF 20334000   mov     edi, 00403320                    ; pediy
004013C8  |.  BE 20334000   mov     esi, 00403320                    ; pediy
004013CD  |>  AC            /lods    byte ptr [esi]                  ; 循環迭代用戶名字符串
004013CE  |.  0C 00         |or      al, 0
004013D0  |.  74 05         |je      short 004013D7
004013D2  |.  0C 20         |or      al, 20
004013D4  |.  AA            |stos    byte ptr es:[edi] 004013D5  |.^ EB F6         \jmp     short 004013CD
004013D7  |>  BF A0324000   mov     edi, 004032A0
004013DC  |.  BE 60334000   mov     esi, 00403360                    ; 12345
004013E1  |.  8D1D 20334000 lea     ebx, dword ptr [403320] 004013E7  |.  33C9          xor ecx, ecx 004013E9  |>  AC            /lods    byte ptr [esi]                  ; 循環迭代 密碼
004013EA  |.  0C 00         |or      al, 0
004013EC  |.  74 17         |je      short 00401405
004013EE  |.  8A13          |mov     dl, byte ptr [ebx]              ; 循環迭代 用戶名
004013F0  |.  2AD0          |sub     dl, al                          ; 用戶名字符 - 密碼字符
004013F2  |.  80CA 00       |or      dl, 0                           ; 若是相同，則跳轉出錯
004013F5  |.  74 3E         |je      short 00401435
004013F7  |.  8AC2          |mov al, dl 004013F9  |.  24 0F         |and     al, 0F
004013FB  |.  0C 00         |or      al, 0                           ; al爲0？
004013FD  |.  74 36         |je      short 00401435                  ; 爲0則跳轉出錯
004013FF  |.  AA            |stos    byte ptr es:[edi]               ; 保存al成表
00401400  |.  02C8          |add     cl, al                          ; 結果累加
00401402  |.  43            |inc ebx 00401403  |.^ EB E4         \jmp     short 004013E9
00401405  |>  890D 6A324000 mov     dword ptr [40326A], ecx          ; 保存累加結果
0040140B  |.  E8 27020000   call    00401637                         ; 關鍵call
00401410  |.  BE A0324000   mov     esi, 004032A0
00401415  |.  8B15 62324000 mov     edx, dword ptr [403262]          ; 取密碼長度
0040141B  |.  C1EA 02       shr     edx, 2                           ; 邏輯右移
0040141E  |.  03F2          add esi, edx 00401420  |.  8A06          mov     al, byte ptr [esi]               ; 表中取值
00401422  |.  33D2          xor edx, edx 00401424  |.  8B15 6E324000 mov     edx, dword ptr [40326E] 0040142A  |.  2BD0          sub edx, eax 0040142C  |.  A1 6A324000   mov     eax, dword ptr [40326A] 00401431  |.  3BC2          cmp eax, edx 00401433      75 31         jz     short 00401466
00401435  |>  68 00200000   push    2000                             ; /Style = MB_OK|MB_TASKMODAL
0040143A  |.  68 D1314000   push    004031D1                         ; | error
0040143F  |.  68 F9314000   push    004031F9                         ; | sorry cracker, wrong.
00401444  |.  FF75 08       push    dword ptr [ebp+8]                ; |hOwner
00401447  |.  E8 02080000   call    <jmp.&USER32.MessageBoxA>        ; \MessageBoxA
0040144C  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040144E  |.  68 E0324000   push    004032E0                         ; |Destination = cztria~1.004032E0
00401453  |.  E8 56080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory
00401458  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040145A  |.  68 A0334000   push    004033A0                         ; |Destination = cztria~1.004033A0
0040145F  |.  E8 4A080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory
00401464  |.  EB 2F         jmp     short 00401495
00401466  |>  68 00200000   push    2000                             ; /Style = MB_OK|MB_TASKMODAL
0040146B  |.  68 E5314000   push    004031E5                         ; | <registered>
00401470  |.  68 10324000   push    00403210                         ; | you did it!
00401475  |.  FF75 08       push    dword ptr [ebp+8]                ; |hOwner
00401478  |.  E8 D1070000   call    <jmp.&USER32.MessageBoxA>        ; \MessageBoxA
0040147D  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040147F  |.  68 E0324000   push    004032E0                         ; |Destination = cztria~1.004032E0
00401484  |.  E8 25080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory
00401489  |.  6A 40         push    40                               ; /Length = 40 (64.)
0040148B  |.  68 A0334000   push    004033A0                         ; |Destination = cztria~1.004033A0
00401490  |.  E8 19080000   call    <jmp.&KERNEL32.RtlZeroMemory>    ; \RtlZeroMemory

跟入 0040140B |. E8 27020000 call 00401637 ; 關鍵call字符串

00401637  /$  BE A0324000   mov     esi, 004032A0
0040163C  |.  8B15 62324000 mov     edx, dword ptr [403262]          ; 取密碼長度
00401642  |.  52            push edx 00401643  |.  33C0          xor eax, eax 00401645  |.  83EA 01       sub     edx, 1
00401648  |.  03F2          add esi, edx 0040164A  |.  8A06          mov     al, byte ptr [esi]               ; 表中取值
0040164C  |.  F7E0          mul eax 0040164E  |.  5A            pop edx 0040164F  |.  83EA 01       sub     edx, 1
00401652  |.  F7E2          mul edx 00401654  |.  B9 01000000   mov     ecx, 1
00401659  |>  2BC1          /sub eax, ecx 0040165B  |.  83F8 00       |cmp     eax, 0                          ; eax爲0？
0040165E  |.  7E 08         |jle     short 00401668
00401660  |.  83C2 01       |add     edx, 1
00401663  |.  83C1 02       |add     ecx, 2
00401666  |.^ EB F1         \jmp     short 00401659
00401668  |>  52            push    edx                              ; 保存edx
00401669  |.  BE A0324000   mov     esi, 004032A0
0040166E  |.  8BFE          mov edi, esi 00401670  |.  8B15 62324000 mov     edx, dword ptr [403262]          ; 取密碼長度
00401676  |.  33C0          xor eax, eax 00401678  |.  83EA 01       sub     edx, 1
0040167B  |.  03F2          add esi, edx 0040167D  |.  8A06          mov     al, byte ptr [esi]               ; 表中取值
0040167F  |.  83C0 01       add     eax, 1
00401682  |.  5A            pop edx 00401683  |.  03C2          add eax, edx 00401685  |.  D1E8          shr     eax, 1
00401687  |.  8B15 62324000 mov     edx, dword ptr [403262]          ; 取密碼長度
0040168D  |.  03FA          add edi, edx 0040168F  |.  AA            stos    byte ptr es:[edi] 00401690  |.  F7E0          mul eax 00401692  |.  8B15 62324000 mov     edx, dword ptr [403262]          ; 取密碼長度
00401698  |.  83EA 01       sub     edx, 1
0040169B  |.  F7E2          mul edx 0040169D  |.  B9 01000000   mov     ecx, 1
004016A2  |>  2BC1          /sub eax, ecx 004016A4  |.  83F8 00       |cmp     eax, 0                          ; eax爲0？
004016A7  |.  7E 08         |jle     short 004016B1
004016A9  |.  83C2 01       |add     edx, 1
004016AC  |.  83C1 02       |add     ecx, 2
004016AF  |.^ EB F1         \jmp     short 004016A2
004016B1  |>  52            push edx 004016B2  |.  BE A0324000   mov     esi, 004032A0
004016B7  |.  8B15 62324000 mov     edx, dword ptr [403262]          ; 取密碼長度
004016BD  |.  33C0          xor eax, eax 004016BF  |.  03F2          add esi, edx 004016C1  |.  8A06          mov     al, byte ptr [esi]               ; 取表中末位
004016C3  |.  83C0 01       add     eax, 1
004016C6  |.  5A            pop edx 004016C7  |.  03C2          add eax, edx 004016C9  |.  D1E8          shr     eax, 1
004016CB  |.  A3 6E324000   mov     dword ptr [40326E], eax          ; 保存結果
004016D0  \.  C3            retn